| Index Home About Search for Google's copy of this article Index Home About Newsgroups: sci.aeronautics.airliners From: rdd@rascal.ics.utexas.edu (Robert Dorsett) Subject: NTSB DC-10 excerpts Date: Wed, 25 Nov 92 02:26:16 CST It's been about two years since I last posted this, so... Excerpts from the NTSB accident report on the Chicago O'Hare crash: Synopsis: About 1504 CDT, May 25, 1979, American Airlines Flight 191, a McDonnell-Douglas DC-10-10 aircraft, crashed into an open field just short of a trailer park about 4600' northwest of the departure end of runway 32R at Chicago-O'Hare Internat- ional Airport, Illinois. Flight 191 was taking off from Runway 32R. The weather was clear and the vis- ibility was 15 miles. During the takeoff rotation, the left engine and pylon assembly and about 3 ft of the leading edge of the left wing separated from the aircraft and fell to the runway. Flight 191 continued to climb to about 325' above the ground and then began to roll to the left. The aircraft con- tinued to roll to the left until the wings were past the vertical position, and during the roll, the aircraft's nose pitched down below the horizon. Flight 191 crashed into the open field and the wreckage scattered into an adjacent trailer park. The aircraft was destroyed in the crash and subsequent fire. Two hundred and seventy-one persons on board Flight 191 were killed; two persons on the ground were killed, and two others were injured. An old aircraft hangar, several automobiles, and a mobile home were destroyed. The National Transportation Safety Board determines that the probable cause of this accident was the asymmetrical stall and the ensuing roll of the air- craft because of the uncommanded retraction of the left wing outboard leading edge slats and the loss of stall warning and slat disagreement indication sys- tems resulting from maintenance-induced damage leading to the separation of the No. 1 engine and pylon assembly at a critical point during takeoff. The sep- aration resulted from damage by improper maintenance procedures which led to failure of the pylon structure. Contributing to the cause of the accident were the vulnerability of the design of the pylon attach points to maintenance damage; the vulnerability of the design of the leading edge slat system to the damage which produced asymmetry; deficiencies in Federal Aviation Administration surveillance and reporting sys- tems which failed to detect and prevent the use of improper maintenance proced- ures; deficiencies in the practices and communications among the operators, the manufacturer, and the FAA which failed to determine and disseminate the particulars during previous maintenance damage incidents; and the intolerance of prescribed operational procedures to this unique emergency. Findings (p. 67) 1. The engine and pylon assembly separated either at or immediately after takeoff. The flightcrew was committed to continue the takeoff. 2. The aft end of the pylon assembly began to separate in the forward flange of the aft bulkhead. 3. The structural separation of the pylon was caused by a complete failure of the forward flange of the aft bulkhead after its residual strength had been critically reduced by the fracture and subsequent service life. 4. The overload fracture and fatigue cracking on the pylon aft bulkhead's upper flange were the only preexisting damage on the bulkhead. The length of the overload fracture and fatigue cracking was about 13 inches. The fracture was caused by an upward movement of the aft end of the pylon which brought the upper flange and its fasteners into contact with the wing clevis. 5. The pylon to wing attach hardware was properly installed at all attachment points. 6. All electrical power to the No. 1 AC generator bus and No. 1 DC bus was lost after the pylon separated. The captain's flight director instrument, the stall warning system, and the slat disagreement warning light systems were rendered inoperative. Power to these buses was never restored. 7. The No. 1 hydraulic system was lost when the pylon separated. Hydraulic systems No. 2 and No. 3 operated at their full capability throughout the flight. Except for spoiler panels No. 2 and No. 4 on each wing, all flight controls were operating. 8. The hydraulic lines and followup cables of the drive actuator for the left wing's outboard leading edge slat were severed by the separation of the pylon and the left wing's outboard slats retracted during climbout. The retraction of the slats caused an asymmetric stall and subsequent loss of control of the aircraft. 9. The flightcrew could not see the wings and engines from the cockpit. Because of the loss of the slat disagreement light and the stall warning system, the flightcrew would not have received an electronic warning of either the slat asymmetry or the stall. The loss of the warning systems created a situation which afforded the flightcrew an inadequate opportunity to recognize and prevent the ensuing stall of the aircraft. 10. The flightcrew flew the aircraft in accordance with the prescribed emer- gency procedure, which called for the climbout to be flown at V2 speed. V2 was 6 KIAS below the stall speed for the left wing. The deceleration to V2 speed caused the aircraft to stall. The start of the left roll was the only warning the pilot had of the onset of the stall. 11. The pylon was damaged during maintenance performed on the accident aircraft at American Airline's Maintenance Facility at Tulsa, Oklahoma, on March 29 and 30, 1979. 12. The design of the aft bulkhead made the flange vulnerable to damage when the pylon was being separated or attached. 13. American Airlines engineering personnel developed an ECO to remove and reinstall the pylon and engine as a single unit. The ECO directed that the combined engine and pylon assembly be supported, lowered, and raised by a forklift. American Airlines engineering personnel did not perform an adequate evaluation of either the capability of the forklift to provide the required precision for the task, or the degree of difficulty involved in placing the lift properly, or the consequences of placing the lift improperly. The CO did not emphasize the precision required to place the forklift properly. 14. The FAA does not approve the carriers' maintenance procedures, and a carrier has the right to change its maintenance procedures without FAA approval. 15. American Airlines personnel removed the aft bulkhead's bolt and bushing before removing the forward bulkhead attach fittings. This permitted the forward bulkhead to act as a pivot. Any advertent or inadvertent loss of forklift support to the engine and pylon assembly would produce an upward movement at the aft bulkhead's upper flange and bring it into contact with the wing clevis. 16. American Airlines maintenance personnel did not report formally to their maintenance engineering staff either their deviation from the removal sequence contained in the ECO or the difficulties they had encountered in accomplishing the ECO's procedures. 17. American Airline's engineering personnel did not perform a thorough evaluation of all aspects of the maintenance procedures before they formulated the ECO. The engineering and supervisory personnel did not monitor the performance of the ECO to ensure either that it was being accomplished properly or if their maintenance personnel were encountering unforeseen difficulties in performing the assigned tasks. 18. The nine situations in which damage was sustained and cracks were found on the upper flange were limited to those operations wherein the engine and pylon assembly was supported by a forklift. 19. On December 19, 1978, and Feb. 22, 1979, Continental Airlines maintenance personnel damaged aft bulkhead upper flanges in a manner similar to the damage noted on the accident aircraft. The carrier classified the cause of the damage as maintenance error. Neither the air carrier nor the manufacturer interpreted the regulation to require that it further investigate or report the damages to the FAA. 20. The original certification's fatigue-damage assessment was in conformance with the existing requirements. 21. The design of the stall warning system lacked sufficient redundancy; there was only one stickshaker motor; and further, the design of the system did not provide for crossover information to the left and right stall warning computers from the applicable leading edge slat sensors on the opposite side of the aircraft. 22. The design of the leading edge slat system did not include positive mechanical locking devices to prevent movement of the slats by external loads following a failure of the primary controls. Certification was based upon acceptable flight characteristics with an asymmetrical leading edge slat condition. 23. At the time of DC-10 certification, the structural separation of an engine pylon was not considered. Thus, multiple failures of other systems resulting from this single event was not considered. Additional excerpts: [design requirements for slats] "The motion on the flaps on opposite sides of the plane of symmetry must be synchronized unless the aircraft has safe characteristics with the flaps retracted on one side and extended on the other." Since the left and right inboard slats are controlled by a single valve and actuated by a common drum and the left and right outboard slats receive their command from mechanically linked control valves which are "slaved" to the inboard slats by the followup cable, the synchronization requirement was satisfied. However, since the cable drum actuating mechanisms of the left and right outboard slats were independent of each other, the possibility existed that one outboard slat might fail to respond to a commanded movement. Therefore, the safe flight characteristics of the aircraft with asymmetrical outboard slats were demonstrated by test flight. These flight characteristics were investigated within an airspeed range bounded by the limiting airspeed for the takeoff slat positions260 ktsand the stall warning speed; the flight test did not investigate these characteristics under takeoff conditions. In addition, a slat disagree warning light system was installed which, when illuminated, indicated that the slat handle and slat position disagree, or the slats are in transit, or the slats have been extended automatically. The program engineer stated that the commanded slat position is held by trapped fluid in the actuating cylinder, and that no consideration was given to an alternate locking mechanism. The slats' hydraulic lines and followup cables were routed as close as possible to primary structure for protection; however, routing them behind the wing's front spar was not considered because of interference with other systems. "The branch chief of the Reliability and Safety Engineering Organization of the Douglas Aircraft Company described the failure mode and effects analysis (FMEA) and fault analysis. The witness indicated that the FMEA was a basic working document in which rational failure modes were postulated and analyzed; vendors and subcontractors were requested to perform similar analyses on equipment they supplied to McDonnell-Douglas. Previous design and service experience was incorporated in the initial DC-10-10's FMEA's, and analyses were modified as the design progressed. The FMEA's were synthesized to make fault analyses, which were system-oriented summary documents submitted to the FAA to satisfy 14 CFR 25.1309. The FAA could have requested and could have reviewed the FMEA's. The basic regulations under which the slats were certified did not require accountability for multiple failures. The slat fault analysis submitted to the FAA listed 11 faults or failures, all of which were correctable by the flightcrew. However, one multiple failureerroneous motion transmitted to the right-hand outboard slats and an engine failure on the appropriate side was considered by McDonnell-Douglas in its FMEA. The FMEA noted that the "failure increases the amount of yaw but would be critical only under the most adverse flight or takeoff conditions. The probability of both failures occurring is less than 1 x 10e-10 [a popular number with airframe manufacturers!]." [...] "The December 1, 1978 revision of 14 CFR 25.571 retitled the regulation "Damage-Tolerance and Fatigue Evaluation of Structure." The fail-safe evaluation must now include damage modes due to fatigue, corrosion, and accidental damage. According to the manufacturer, the consideration for accidental damage was limited to damage which can be inflicted during routine maintenance and aircraft servicing." [...] "Because of the designed redundancy in the aircraft's hydraulic and electrical systems, the losses of those systems powered by the No. 1 engine should not have affected the crew's ability to control the aircraft. However, as the pylon separated from the aircraft, the forward bulkhead contacted and severed four other hydraulic lines and two cables which were routed through the wing leading edge forward of the bulkhead. These hydraulic lines were the operating lines from the leading edge slat control valve, which was located inboard of the pylon, and the actuating cylinders, which extend and retract the outboard leading edge slats. Two of the lines were connected to the No. 1 hydraulic system and two were connected to the No. 3 system, thus providing the redundancy to cope with a single hydraulic system failure. The cables which were severed provided feedback of the leading edge slat position so that the control valve would be nulled when slat position agreed with position commanded by the cockpit control. The severing of the hydraulic lines in the leading edge of the left wing could have resulted in the eventual loss of No. 3 hydraulic system because of fluid depletion. However, even at the most rapid rate of leakage possible, the system would have operated throughout the flight. The extended No. 3 spoiler panel on the right wing, which was operated by the No. 3 hydraulic system, confirmed that this hydraulic system was operating. Since two of the three hydraulic systems were operative, the Safety Board concludes that, except for the No. 2 and No. 4 spoiler panels on both wings which were powered by the No. 1 hydraulic systems, all flight controls were operating. Therefore, except for the significant effect that the severing of the No. 3 hydraulic system's lines had on the left leading edge slat system, the fluid leak did not play a role in the accident. During takeoff, as with any normal takeoff, the leading edge slats were extended to provide increased aerodynamic lift on the wings . When the slats are extended and the control valve is nulled, hydraulic fluid is trapped in the actuating cylinder and operating lines. The incompressiblity of this fluid reacts against any external air loads and holds the slats extended. This is the only lock provided by the design. Thus, when the lines were severed and the trapped hydraulic fluid was lost, air loads forced the left outboard slats to retract. While other failures were not critical, the uncommanded movement of these leading edge slats had a profound effect on the aerodynamic performance and controllability of the aircraft. With the left outboard slats retracted and all others extended, the lift of the left wing was reduced and the airspeed at which that wing would stall was increased. The simulator tests showed that even with the loss of the No. 2 and No. 4 spoilers, sufficient lateral control was available from the ailerons and other spoilers to offset the asymmetric lift caused by left slat retraction at airspeeds above that at which the wing would stall. However, the stall speed for the left wing increased to 159 KIAS. [...] The Safety Board is also concerned that the designs of the flight control, hydraulic, and electrical systems in the DC-10 aircraft were such that all were affected by the pylon separation to the extent that the crew was unable to ascertain the measures needed to maintain control of the aircraft. The airworthiness regulations in effect when the DC-10 was certificated were augmented by a Special Condition, the provisions of which had to be met before the aircraft's fully powered control system would be certificated. The Special Condition required that the aircraft be capable of continued flight and of being landed safely after failure of the flight control system, including lift devices. These capabilities must be demonstrated by analysis or test, or both. However, the Special Condition, as it applied to the slat control system, was consistent with the basic airworthiness regulations in effect at the time. The basic airworthiness regulations specified requirements for wing flap asymmetry only and did not include specific consideration of other lift devices. Because the leading edge slat design did not contain any novel or unusual features, it was certificated under the basic regulation. The flap control requirements for symmetry and synchronization were applied to and satisfied by the slat system design. Since a malfunction of the slat actuating system could disrupt the operation of an outboard slat segment, a fault analysis was conducted to explore the probability and effects of both an uncommanded movement of the outboard slats and the failure of the outboard slats to respond to a commanded movement. The fault analysis concluded that the aircraft could be flown safely with this asymmetry. Other aircraft designs include positive mechanical locking devices to prevent movement of slats by external loads following a primary failure. The DC-10 design did not include such a feature nor was it deemed necessary, since compliance with the regulations was based upon analysis of those failure modes which could result in asymmetrical positioning of the leading edge devices and a demonstration that sufficient lateral control was available to compensate for the asymmetrical conditions throughout the aircraft's flight envelope. The flight tests conducted to evaluate the controllability of the aircraft were limited to a minimum airspeed compatible with stall-warning activation predicated upon the slat-retracted configuration. Search for Google's copy of this article Search for Google's copy of this article Search for Google's copy of this article Search for Google's copy of this article ... Search for Google's copy of this article Newsgroups: sci.aeronautics.airliners From: rdd@cactus.org (Robert Dorsett) Subject: Slat extension locks Date: 29 Jun 93 09:22:55 PDT In previous DC-10 discussions (last year, mainly), I erroneously referred to the Boeing use of "jackscrews" to lock leading edge devices. This is incorrect. Jackscrews are used to some extent for trailing edge extension, but aren't used for leading edge devices in any airplanes I'm familiar with. I recently learned that the locking mechanism for the LED's is to trap hydraulic fluid downstream of the actuator. The locking mechanism is located in the extension piston itself, and may not be opened again except by more hydraulic pressure, during the retract cycle. Thus, if the hydraulic system is lost, the device itself will remain firmly wedged extended, with a small quantity of hydraulic fluid present in the sealed piston. Probably held more firmly than with hydraulic pressure present. I'm told that this system is so reliable that it's caused many a problem for maintenance-type people once an actuator itself fails: there's no way to retract the slats on the ground. Boeing apparently sells a little hand- pump to permit the fluid to be removed, but I'm told of one incident which involved the use of a hacksaw. :-) Sorry for any confusion, for those who hang on my every word. :-) Egomaniacally, - Robert Dorsett rdd@cactus.org ...cs.utexas.edu!cactus.org!rdd Search for Google's copy of this article Search for Google's copy of this article Search for Google's copy of this article Index ... About | |
|
